Subject: Re: bpf performance suckage
To: None <itojun@iijlab.net>
From: Darren Reed <darrenr@reed.wattle.id.au>
List: tech-net
Date: 06/20/2000 12:58:12
In some email I received from itojun@iijlab.net, sie wrote:
[...]
> 	new code will behave just like traditional 4.4BSDdoes, so packets will
> 	be packed like this:
> 	- single header mbuf (MHLEN) if len <= MHLEN
> 	- header mbuf + normal mbuf (MHLEN + MLEN) if len <= MHLEN + MLEN
> 	- single cluster mbuf (MCLBYTES), or multiple cluster mbufs otherwise
> 	with the new code, upper-layer headers on a IPv6 packet would exceed
> 	the first mbuf easily.  if bpf code looks at first mbuf only, we will
> 	fail to catch IPv6 packet by bpf.

Hmmm.  I've changed my local bpf_filter() to be like this:

/*
 * Execute the filter program starting at pc on the packet p
 * wirelen is the length of the original packet
 * buflen is the amount of data present
 * For the kernel, p is assumed to be a pointer to an mbuf if buflen is 0,
 * in all other cases, p is a pointer to a buffer and buflen is its size.
 */   
u_int
bpf_filter(pc, p, wirelen, buflen)
        register struct bpf_insn *pc;
        register u_char *p;
        u_int wirelen;
        register u_int buflen;    
{       
        register u_int32 A, X;
        register int k;
        int32 mem[BPF_MEMWORDS];
#ifdef        KERNEL 
        struct mbuf *m, *n;
        int merr, len;                  

        if (buflen == 0) {
                m = (struct mbuf *)p;
                p = mtod(m, char *);
                buflen = m->m_len;
        } else
                m = NULL;
#endif
...
                case BPF_LD|BPF_W|BPF_ABS:
                        k = pc->k;
                        if (k + sizeof(int32) > buflen) {
#ifdef KERNEL 
                                if (m == NULL)
                                        return 0;
                                A = m_xword(m, k, &merr);
                                if (merr != 0)
                                        return 0;
                                continue;
#else
                                return 0;
#endif
                        }
...

I believe that will work for you ?  Do you want me to send you the
bpf_filter.c I'm testing so you can test it with your changes ?

Darren